[Lvfs-announce] Adding CVEs to firmware updates

Hi all,

At the moment a lot of firmware updates reference CVEs in the update
description. This is a broadly a good thing, as users can which
security issues are fixed with each update.

The problem with putting the CVE items in the update description is
that you can't very well search for the update that fixes a specific
CVE as it would be an untokenised free text search across all firmware
on the LVFS. The update description is sometimes 70% CVE-XXXX-XXXXX
values, and this also makes it very hard to show it in a nice way for
end users. You also can't display the update description with
clickable links to the CVEs when it's plain text.

This afternoon I'm going to deploy a new version of the LVFS that
allows you to add the CVEs in a separate section to the update
description. You can paste in values like
CVE-2019-12345,CVE-2019-54321 into the new "Issues" tab in the
component view, or you can even import the CVE numbers automatically
from the update details panel. When they are autoimported the CVE
numbers are removed from the update description and some minor fixup
to the prose may be required.

For firmware not yet in testing or stable the CVE numbers need to be
moved out of the update text. This doesn't affect firmware already in
stable, although I'll fix up the most popular firmware that's being
shown to users now. If you're including the update descriptions in the
metainfo.xml rather than adding them "online" then you can include
them like so:

    <release>
      <issues>
        <issue type="cve">CVE-2016-00000</issue>
        <issue type="cve">CVE-2017-00000</issue>
      </issues>
    </release>

Although the CVE data is stored in a different table in the database,
we are merging it back in to the update description during remote
generation at the moment. When most clients like gnome-software and
gnome-firmware are capable of processing the new <issues> metadata
correctly we can switch over to not adding it to the update
description. This will probably be many months given how slow some
distros are at updating the GUI clients and fwupd itself.

This should be uncontroversial and fairly easy to understand, but if
anyone has any problems or concerns, please email me off list.

Thanks,

Richard.